Icegram Engage: PHP Object Injection by Contributor-level users
Summary
Icegram Engage up to and including version 3.1.31 contains a PHP Object Injection flaw (CWE-502, deserialization of untrusted data). An authenticated user with Contributor rights or higher can submit crafted data that the plugin deserializes, which can allow manipulation of server-side processing. The impact depends on whether a usable gadget chain exists on the site, and the CNA rates the impact as high for confidentiality, integrity and availability.
Affected
- Icegram Engage WordPress plugin, versions up to and including 3.1.31
- Required privilege: Contributor (authenticated)
Fixed in
- Version 3.1.44 or later, according to the CNA record and the Patchstack advisory
- The latest release on WordPress.org should be installed
Workaround
- No vendor-published workaround known.
- Until the update is applied, restrict account registration and review accounts with Contributor or higher rights.
Exploitation
- Exploited in the wild: No evidence found at the time of research.
- CISA KEV: Not listed in the sources reviewed; check the live catalog.
- Public proof of concept: None confirmed.
- CISA SSVC: Exploitation none, automatable no, technical impact total.
- EPSS: Unknown.
Our recommendation
- Update Icegram Engage to version 3.1.44 or later, ideally the latest release.
- Check which Icegram versions are installed on all WordPress sites.
- Review and remove unneeded Contributor-or-higher accounts and restrict self-registration.
- Review installed plugins and themes for gadget chains that increase the impact.
- Monitor for unusual admin or file activity and recheck NVD and KEV later.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-97284 patchstack.com
- CVE record mirror (threatint) cve.threatint.com
- OpenCVE CVE-2026-97284 app.opencve.io
- Icegram changelog www.icegram.com
- WordPress.org Icegram plugin en-ca.wordpress.org
- Strix CVE-2026-97284 www.strix.ai
- TheHackerWire CVE-2026-97284 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:57.
Original description (NVD)
Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.